217 results · Clear filters · Feed
-
Critical max 10.0SSA-047424 2 CVEs
SSA-047424: Code Execution and SQL Injection Vulnerabilities in OZW Web Servers
OZW672 and OZW772 Web Server versions contain vulnerabilities that could allow an attacker to execute arbitrary code on the device with root privileges (in versions before V8.0) or to authenticate as Administrator user (in versions before V6.0). Siemens has r…
-
Critical max 9.8SSA-443402 67 CVEs
SSA-443402: Multiple SQL Injection Vulnerabilities in TeleControl Server Basic before V3.1.2.2
TeleControl Server Basic before V3.1.2.2 contains multiple SQL Injection vulnerabilities that could allow an attacker to read and write to the application's DB, cause denial of service and execute code in an OS shell with limited "NT AUTHORITY\NetworkService"…
-
Critical max 9.8SSA-817234 5 CVEs
SSA-817234: Multiple Kubernetes Ingress NGINX Controller Vulnerabilities in Insights Hub Private Cloud
Insights Hub Private Cloud is affected by multiple vulnerabilities in Ingress NGINX Controller for Kubernetes. These vulnerabilities could lead to arbitrary code execution in the context of the ingress-nginx controller, or disclosure of Secrets accessible to …
-
Critical max 10.0SSA-187636 9 CVEs
SSA-187636: Multiple Vulnerabilities in SENTRON 7KT PAC1260 Data Manager
SENTRON 7KT PAC1260 Data Manager is affected by multiple vulnerabilities as listed below. Software fixes can no longer be provided for The SENTRON 7KT PAC1260 Data Manager. This advisory documents the known open vulnerabilities. To fix the vulnerabilities, Si…
-
Critical max 9.8SSA-787280 1 CVE
SSA-787280: Unlocked Bootloader Vulnerability in SINAMICS S200
A specific range of produced SINAMICS S200 devices contains an unlocked bootloader vulnerability that could allow an attacker to download untrusted firmware that could damage or compromise the device. For delivered products listed below Siemens recommends cou…
-
Critical max 9.8SSA-615740 6 CVEs
SSA-615740: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP3
SINEMA Remote Connect Client before V3.2 SP3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
Critical max 9.1SSA-515903 3 CVEs
SSA-515903: Multiple Vulnerabilities in SiPass integrated AC5102 / ACC-G2 and ACC-AP
SiPass integrated ACC (Advanced Central Controller) devices contain multiple vulnerabilities that could allow attackers to execute commands on the devices with root privileges and access sensitive data. Siemens has released new versions for the affected produ…
-
Critical max 9.1SSA-992434 1 CVE
SSA-992434: Directory Traversal Vulnerability in Third-Party Component in SiPass integrated
SiPass integrated is affected by a directory traversal vulnerability in the third-party component DotNetZip. The vulnerability could allow an attacker to execute arbitrary code on the application server, if a specially crafted backup set is used for a restore…
-
Critical max 10.0
SSA-246355: Multiple Vulnerabilities in Tableau Server Component of Opcenter Intelligence
The Tableau Server component in Opcenter Intelligence contains multiple vulnerabilities as described below. Siemens has released a new version for Opcenter Intelligence and recommends to update to the latest version and to install the latest available version…
first Feb 11, 2025 -
Critical max 9.8SSA-769027 72 CVEs
SSA-769027: Multiple Vulnerabilities fixed in SCALANCE W700 IEEE 802.11ax devices before V3.0.0
SCALANCE W-700 IEEE 802.11ax family devices are affected by multiple vulnerabilities. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 9.1
SSA-629254: Remote Code Execution Vulnerability in SIMATIC SCADA and PCS 7 systems
The products listed below contain a remote code execution vulnerability that could allow an authenticated remote attacker to execute arbitrary code with high privileges. Siemens has released new versions for several affected products and recommends to update …
first Sep 10, 2024 -
Critical max 9.9
SSA-915275: Multiple Vulnerabilities in SINEC INS Before V1.0 SP2 Update 3
SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version.
-
Critical max 10.0SSA-454789 1 CVE
SSA-454789: Deserialization Vulnerability in TeleControl Server Basic V3.1
TeleControl Server Basic V3.1 contains a deserialization vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the device. Siemens has released new versions for the affected products and recommends to update to the latest ver…
-
Critical max 10.0SSA-333468 4 CVEs
SSA-333468: Multiple Vulnerabilities in InterMesh Subscriber Devices
InterMesh Subscriber devices contain multiple vulnerabilities that could allow an unauthenticated remote attacker to execute arbitrary code with root privileges. Siemens has released new versions for the affected products and recommends to update to the lates…
-
Critical max 9.8
SSA-955858: Multiple Vulnerabilities in LOGO! 8 BM Devices
LOGO! 8 BM (incl. SIPLUS variants) contains multiple web-related vulnerabilities. These could allow an attacker to execute code remotely, put the device into a denial of service state or retrieve parts of the memory. The vulnerabilities are related to the har…
first Oct 11, 2022 -
Critical max 9.8SSA-850560 1 CVE
SSA-850560: Use of 4-Digit PIN in SENTRON PAC3200 Devices
SENTRON PAC3200 only provide a 4-digit PIN to protect from administrative access via Modbus TCP interface. Attackers with access to the Modbus TCP interface could easily bypass this protection by brute-force attacks or by monitoring the Modbus cleartext commu…
-
Critical max 9.1SSA-721642 1 CVE
SSA-721642: Injection Vulnerability in SCALANCE W700 802.11 AX Family Before V2.4
Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 8.6SSA-417159 7 CVEs
SSA-417159: Multiple Vulnerabilities in SINEMA Remote Connect Client Before V3.2 SP2
SINEMA Remote Connect Client before V3.2 SP2 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Client and recommends to update to the latest version.
-
Critical max 10.0SSA-359713 1 CVE
SSA-359713: Authorization Bypass Vulnerability in Industrial Edge Management
Industrial Edge Management contains an Authorization Bypass vulnerability that could allow an unauthenticated remote attacker to impersonate other devices onboarded to the system. Siemens has released new versions for the affected products and recommends to u…
-
Critical max 9.1
SSA-784301: Multiple Vulnerabilities in SINEC NMS Before V3.0
SINEC NMS before V3.0 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC NMS and recommends to update to the latest version.
-
Critical max 9.8
SSA-625850: Multiple WIBU Systems CodeMeter Vulnerabilities Affecting the Desigo CC Product Family and SENTRON powermanager
Versions V5.0 through V7 of the Desigo CC product family (Desigo CC, Desigo CC Compact, Desigo CC Connect, Cerberus DMS), as well as the Desigo CC-based SENTRON powermanager, are affected by multiple vulnerabilities in the underlying third-party component WIB…
first Nov 14, 2023 -
Critical max 9.1
SSA-180704: Multiple Vulnerabilities in SCALANCE M-800 Family Before V8.0
SCALANCE M-800 family before V8.0 is affected by multiple vulnerabilities. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens recommends countermeasures for products where fixes are not, or…
first Dec 12, 2023 -
Critical max 9.8SSA-071402 2 CVEs
SSA-071402: Multiple Vulnerabilities in SICAM Products
Multiple SICAM products are affected by unauthorized password reset and firmware downgrade vulnerabilities that could lead to privilege escalation and potential leak of information, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICAM EG…
-
Critical max 10.0
SSA-750274: Impact of CVE-2024-3400 on RUGGEDCOM APE1808 devices configured with Palo Alto Networks Virtual NGFW
Palo Alto Networks has published [1] information on CVE-2024-3400 in PAN-OS. This advisory addresses Siemens Industrial products affected by this vulnerability. Siemens has released a new version of Palo Alto Networks Virtual NGFW for RUGGEDCOM APE1808 and re…
first Apr 19, 2024 -
Critical max 9.8
SSA-484086: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.1
SINEMA Remote Connect Server is affected by multiple vulnerabilities, including - A cross-site scripting vulnerability in an error message pop up window (CVE-2022-29034) - Several authentication bypass, privilege escalation and integrity check vulnerabilities…
first Jun 14, 2022 -
Critical max 9.6SSA-381581 13 CVEs
SSA-381581: Multiple Vulnerabilities in SINEMA Remote Connect Server before V3.2 SP1
SINEMA Remote Connect Server before V3.2 SP1 is affected by multiple vulnerabilities. Siemens has released a new version for SINEMA Remote Connect Server and recommends to update to the latest version.
-
Critical max 7.8
SSA-337522: Multiple Vulnerabilities in TIM 1531 IRC before V2.4.8
Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Jun 11, 2024 -
Critical max 7.8SSA-625862 23 CVEs
SSA-625862: Multiple Vulnerabilities in Third-Party Components in SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3
SIMATIC CP 1542SP-1 and CP 1543SP-1 before V2.3 are affected by multiple vulnerabilities in third-party components and the integrated web server. Siemens has released new versions for the affected products and recommends to update to the latest versions.
-
Critical max 10.0
SSA-093430: Multiple Vulnerabilities in SIMATIC RTLS Locating Manager before V3.0
Siemens has released a new version for SIMATIC RTLS Locating Manager and recommends to update to the latest version.
first May 14, 2024 -
Critical max 9.3SSA-024584 1 CVE
SSA-024584: Authentication Bypass Vulnerability in PowerSys before V3.11
PowerSys before V3.11 is affected by a vulnerability that could allow a local attacker to bypass authentication, thereby gaining administrative privileges for the managed remote devices. Siemens has released a new version for PowerSys and recommends to update…
-
Critical max 10.0
SSA-968170: Remote Code Execution Vulnerability in SIMATIC STEP 7 V5.x and Derived Products
SIMATIC STEP 7 and PCS 7 contain a database management system that could allow remote users to use embedded functions of the database (local or in a network share) that have impact on the server. An attacker with network access to the server network could lev…
first Jun 13, 2023 -
Critical max 10.0SSA-953710 3 CVEs
SSA-953710: Vulnerabilities in the Network Communication Stack in Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems
Several products used in Desigo Fire Safety UL and Cerberus PRO UL Fire Protection Systems contain buffer overflow vulnerabilities in the network communication stack. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker, who …
-
Critical max 9.8SSA-916916 9 CVEs
SSA-916916: Security Vulnerabilities Fixed in RUGGEDCOM CROSSBOW V5.5
The RUGGEDCOM CROSSBOW server application before V5.5 contains multiple vulnerabilities that could allow an attacker to execute arbitrary database queries via SQL injection attacks, or upload of arbitrary files to the application's file system. The majority o…
-
Critical max 10.0SSA-273900 3 CVEs
SSA-273900: Multiple Vulnerabilities in SIMATIC CN 4100 before V3.0
SIMATIC CN 4100 is vulnerable to use of hard coded credentials including root user and contains an unrestricted USB port that could be misused for insecure boot. Siemens has released a new version for SIMATIC CN 4100 and recommends to update to the latest ver…
-
Critical max 9.8
SSA-240541: WIBU Systems CodeMeter Heap Buffer Overflow Vulnerability in Industrial Products
WIBU Systems published information about a heap buffer overflow vulnerability and associated fix releases of CodeMeter Runtime, a product provided by WIBU Systems and used in several Siemens industrial products for license management. The vulnerability is des…
first Sep 12, 2023 -
Critical max 10.0
SSA-225840: Vulnerabilities in the Network Communication Stack in Sinteso EN and Cerberus PRO EN Fire Protection Systems
Several products used in Sinteso EN and Cerberus PRO EN Fire Protection Systems contain buffer overflow vulnerabilities in the network communication stack. Successful exploitation of the vulnerabilities could allow an unauthenticated attacker, who gained acce…
first Mar 12, 2024 -
Critical max 9.8SSA-885980 3 CVEs
SSA-885980: Multiple Vulnerabilities in Scalance W1750D
The SCALANCE W1750D devices contain multiple vulnerabilities that could allow an attacker to exploit buffer overflow and information disclosure vulnerabilities which could lead to information disclosure or unauthenticated remote code execution. Siemens has re…
-
Critical max 9.8
SSA-831302: Vulnerabilities in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0
Multiple vulnerabilities have been identified in the BIOS of the SIMATIC S7-1500 TM MFP before V1.3.0. Siemens has released a new version for SIMATIC S7-1500 TM MFP - BIOS and recommends to update to the latest version.
first Jun 13, 2023 -
Critical max 9.8
SSA-716164: Multiple Vulnerabilities in Scalance W1750D
The SCALANCE W1750D devices contain multiple vulnerabilities that could allow an attacker to inject commands or exploit buffer overflow vulnerabilities which could lead to sensitive information disclosure, unauthenticated denial of service or unauthenticated …
first Feb 13, 2024 -
Critical max 9.8
SSA-943925: Multiple Vulnerabilities in SINEC NMS before V2.0 SP1
SINEC NMS before V2.0 SP1 is affected by multiple vulnerabilities. Siemens has released an update for SINEC NMS and recommends to update to the latest version.
first Feb 13, 2024